AI-Assisted EDR Evasion Framework Linked to Ransomware Operations

Sophos X-Ops reported that a threat actor built and tested an AI-assisted post-exploitation framework designed to evade endpoint detection and response tools, using a mix of malicious files, Cobalt Strike profiles, Python shellcode-injection scripts, a Telegram Bot API command-and-control channel, and a Cloudflare Worker redirector. Investigators found a supporting Git repository that automated Active Directory discovery and maintained a malware-testing lab with multiple virtual machines to evaluate bypass techniques against Sophos, CrowdStrike, and Microsoft Defender environments; many scripts appeared partly AI-generated and included Russian-language elements.

The framework used a Python payload generator to create Rust- and Go-based payloads with encryption, evasion, and alternate execution methods, ultimately producing nearly 80 modules that tested more than 70 techniques. Sophos said the operators used tools including Cursor, Claude Opus 4.5, and Model Context Protocol to coordinate workflows, ingest public research, and map activity to MITRE ATT&CK, but found no clear evidence that AI independently invented new malware capabilities; the company also linked the development activity to known ransomware deployment and data-theft operations and urged organizations to maintain layered defenses including patching, MFA, passkeys, and strong EDR coverage.